Instructor: Communication plan. 2 2
Another thing we need to consider 3 3
during our preparation phase is our communication plan. 4 4
How are we going to make our communications 5 5
back to home station or up to leadership 6 6
in the event of an incident response? 7 7
This is extremely important, 8 8
especially in large organizations 9 9
where you have a distributed workforce 10 10
around the country or around the world. 11 11
Your teams have to have a secure method of communication 12 12
for managing your incidents. 13 13
Now, this is really important 14 14
because if you have a VoIP system, for instance, 15 15
and that's what you're going to use to communicate, 16 16
well, if an attacker is in that VoIP system, 17 17
they can hear everything you're saying 18 18
and they will be tipped off as to all the things 19 19
you're doing and they can pivot away from you 20 20
and gain access further into your systems 21 21
before you can get them out. 22 22
And so often what we want to do 23 23
is use an out-of-band communication system. 24 24
Now, an out-of-band communication system 25 25
is one where your signals are being sent 26 26
between two parties or two devices 27 27
that are sent via a path or method 28 28
that's different from the primary communication 29 29
between those two parties or devices. 30 30
Now, that's a really complicated way of saying things, 31 31
but let's say normally you would go ahead 32 32
and report to your manager 33 33
using your corporate email account. 34 34
Well, if you think that corporate email has been compromised 35 35
you don't want to use that as your communication method. 36 36
Instead, you want to use an out-of-band communication. 37 37
That might mean you're going to make a call 38 38
from your cell phone to their cell phone, 39 39
or you might use an encrypted path. 40 40
For example, one of the most commonly used ones 41 41
is something like WhatsApp or Signal or Off the Record. 42 42
All of these apps have messaging systems 43 43
with end-to-end encryption, 44 44
so no attacker can see the information 45 45
in between that's being sent. 46 46
And so oftentimes, we'll have a channel set up on WhatsApp 47 47
as a way for us to use as a communication mechanism. 48 48
Now, one of the problems with this 49 49
is using WhatsApp requires you to have a cell phone. 50 50
And so oftentimes, you have to think about 51 51
what is my primary path and what's going to be my backup? 52 52
So what is your backup communication plan going to be? 53 53
Well, you have to consider how you're going to communicate 54 54
with the people who are on call, 55 55
especially when you have a distributed workforce. 56 56
For example, one organization I worked at, 57 57
we had a team that was actually flown out 58 58
to a center that was dealing with an incident. 59 59
Now, that center, they weren't allowed 60 60
to have smartphones inside that organization. 61 61
And so when they went into the building, 62 62
we couldn't communicate with them. 63 63
So we had to have a way for that team to respond to us 64 64
even though they couldn't have smartphones in the building. 65 65
And what we ended up coming up with 66 66
was that every hour, somebody would leave the building, 67 67
go to their car, get their smartphone, 68 68
and then call in to check with us. 69 69
This is a way of doing things, 70 70
but again, it was our backup plan 71 71
that if you can't do this, then you should do this. 72 72
And every hour, send us a message. 73 73
That was one of the ways 74 74
we were able to work our way through this. 75 75
Maybe you're going to send them to an area 76 76
that doesn't have good cellular coverage. 77 77
So instead, they're going to have to use a satellite phone 78 78
or some other method like that. 79 79
You're going to have to think these things through 80 80
for your organization based on your own incidents 81 81
and your own response plans. 82 82
Another thing you want to make sure you're doing 83 83
is always make sure you maintain an up-to-date contact list. 84 84
The best way to prepare for your team's activation 85 85
for a future response is to ensure 86 86
you have an accurate contact list 87 87
that is prepared ahead of time. 88 88
This will include things like their phone numbers 89 89
and email addresses for each member 90 90
of the incident response team, 91 91
as well as others within the organization 92 92
and your third-party partner organizations. 93 93
By ensuring you have an accurate contact list 94 94
that is ready to go, you're going to be better prepared 95 95
when you receive the message 96 96
that your team needs to be activated, 97 97
and in the case of people who have to fly away 98 98
for a remote response, you're ready to go 99 99
because you have all the information you need. 100 100
Another part of your communication plan 101 101
that you have to consider is what is your escalation 102 102
procedure going to be for your organization? 103 103
Basically, at what point should you call 104 104
the on-call person or team? 105 105
What exactly defines when the event or incident 106 106
is bad enough that you need to call somebody 107 107
and wake them up at three in the morning 108 108
instead of waiting till they show up at work 109 109
at 8 a.m. the next day? 110 110
This is especially important 111 111
if you're going to use contract personnel 112 112
because when you call in contract personnel after hours, 113 113
this can actually have huge additional charges 114 114
per the contract, so you need to make sure it's clearly 115 115
outlined based on your organizational priorities 116 116
when you're going to call somebody in. 117 117
If somebody's email was hacked, 118 118
you may not call them in for that, 119 119
but if your credit card system was hacked, 120 120
you may do that for that because it's protected information. 121 121
These are the type of things you have to think about 122 122
and make sure you have the right policies 123 123
and procedures in place. 124 124
Now, another thing we have to think about 125 125
is how are we going to notify people? 126 126
Based on the prioritization and categorization 127 127
of an incident, we're going to have different levels 128 128
of notification from none to an email 129 129
to a 3 a.m. wake-up call. 130 130
If it's a minor incident that's well understood 131 131
and considered to have low or no priority, 132 132
then our organization may have procedures in place 133 133
so the incident handlers and security teams 134 134
will simply take care of the incident 135 135
without telling anybody about it. 136 136
If we have a more serious incident, though, 137 137
we're going to have to follow our procedures 138 138
to notify the right individuals up our organizational chain. 139 139
This may include people like the chief information officer 140 140
or the chief security officer 141 141
or the chief information security officer, 142 142
the incident response team members, 143 143
the system owners, the system administrators, 144 144
our point of contact within human resources, 145 145
a legal department representative, or even public affairs. 146 146
Maybe we even have to call law enforcement. 147 147
All of this and the exact methods 148 148
that you're going to use for these notifications 149 149
will be based on your organization's procedures 150 150
that are going to be developed during this preparation phase 151 151
of the incident response lifecycle. 152 152
Now, in addition to figuring out who you're going to notify, 153 153
you have to know how you're going to notify them. 154 154
This can include using email, internal web portals, 155 155
telephone calls, an in-person update, leaving a voicemail, 156 156
setting up a formal report or other forms of notification 157 157
that your company decides is desirable and effective. 158 158
In most organizations I've worked at in the past, 159 159
we've used a phone call or an in-person notification 160 160
for urgent and high-priority incidents, 161 161
and then we follow it up with an email or a report. 162 162
For a medium-priority issue, 163 163
we generally will rely on an email, a voicemail, 164 164
or possibly even a phone call if it's during working hours. 165 165
If it's a low-priority incident, 166 166
then we may handle this through a daily or weekly report 167 167
or through an intranet portal. 168 168
This is definitely an area where you want to tailor it 169 169
to suit the needs and desires of your organization. 170 170
So you need to make sure you're involving those 171 171
who are going to be notified and ask them 172 172
what method works best for them 173 173
and for which categories they want you to use it. 174 174
The final thing we need to talk about 175 175
when we're dealing with communication plans 176 176
is how far out do you want this information to go? 177 177
And what I mean by that is we want to make sure 178 178
we're preventing unauthorized release of information 179 179
outside of your CSIRT. 180 180
This is because we don't want this information 181 181
prematurely hitting the front page news. 182 182
It is not helpful for an incident to be publicized 183 183
in the press or through social media 184 184
outside of your planned communications. 185 185
Anything that's going to go outside of the team 186 186
needs to go through the appropriate parties 187 187
and through public relations. 188 188
You also need to ensure that parties 189 189
with privileged information do not release this information 190 190
to untrusted parties whether intentionally or inadvertently. 191 191
Remember, if something's going to get out onto Facebook 192 192
or Twitter or onto Google News or any other news site, 193 193
you want to make sure it's done appropriately 194 194
through the organization with your public relations team 195 195
and making sure that they are in the know 196 196
and that they are the ones who are doing that.